AI Scribes for Australian Clinics: Privacy, Consent, Liability

Two in five Australian GPs now use an AI scribe to write up their consultations — up from one in five just over a year ago, per a Royal Australian College of General Practitioners poll. On 5 July, the federal health department confirmed what a lot of practice owners already suspected: adoption is running well ahead of the privacy, consent and safety rules that govern it.

The department's own briefing documents, obtained by The Guardian under freedom of information, put it bluntly: AI scribes "have little oversight." Some route patient audio through offshore cloud servers — and some suppliers don't even know they do.

None of this makes AI scribes a bad idea. Handing an hour a day of typing back to a clinician is genuine admin leverage, and the technology works. It means the tool now carries a compliance layer — and the practitioner, not the vendor, wears the risk.

Start with the Therapeutic Goods Administration. On 30 January 2026, the TGA clarified that an AI scribe which only transcribes a consultation into notes is not a medical device. One that interprets — generating a diagnosis, a differential, or a treatment recommendation the practitioner never stated — is a medical device, and must be listed on the ARTG. Most ambient scribes stay outside the device framework only as long as the clinician reviews and signs off every note.

AHPRA and the RACGP fill in the rest. Their guidance sets out what a practitioner must do when using a scribe: apply human judgement to every output, understand how the tool works and where it fails, tell patients an AI is involved, obtain informed consent before it processes personal information, and retain clinical responsibility for the result. The software is a drafting aid, not a delegate.

The department also flagged a marketing line worth remembering. Some vendors advertise a "30% revenue increase for health professionals with no additional hours" — a claim that, taken at face value, invites exactly the over-reliance the guidance warns against. If a scribe is billed as a revenue engine rather than a documentation aid, read the fine print twice.

Want to know what this means for your business? We'll map it in one call.

This is not only a GP problem. Physiotherapists, psychologists, dentists, podiatrists — any practice that records and documents a patient consultation sits in the same position. And the professional-services businesses adopting AI scribes handle the most sensitive personal information there is: health records. The exposure is real precisely because the upside is.

It lands in three places. Privacy: if audio or transcripts leave Australia, you may be breaching the Australian Privacy Principles — and from 10 December, the Privacy Act's new automated-decision disclosure rules add another layer for many practices. Consent: a "we record for quality" line muttered at reception is not informed consent. Liability: AHPRA has made clear the clinical responsibility stays with the practitioner — if a scribed note is wrong and you sign it, that is on you, not the vendor.

There is a fourth, quieter cost. The RACGP now tells GPs to check with their professional indemnity insurer before adopting a scribe, and insurers are asking about it at renewal. A tool that quietly voids your cover is not a saving. If you are weighing where AI actually pays off in a practice, this is worth a proper look before you commit — the admin-leverage win is real, but only if the compliance base is solid.

Four checks turn a risk into a straightforward tool. First, data residency: confirm — in the contract, not the marketing — that audio and transcripts are stored and processed in Australia. Onshore-built options exist and store data locally, but verify it rather than trust the badge. Second, consent: build a documented consent step into the appointment flow, so a patient understands what is being recorded and can decline. Third, human review: never sign a note you haven't read. That one habit keeps most scribes out of the medical-device net and out of a complaint. Fourth, insurance: one email to your indemnity provider before you roll it out.

This is the gap between free guidance and a working system. The RACGP, AHPRA and TGA tell you the obligations — clearly, and for free. They don't vet your vendor's data flows, write your consent workflow, or configure the tool so a busy front desk actually follows it. That implementation half is where the compliance either holds or quietly fails, and it's the half worth getting a second set of eyes on. We work through this with practices the same way we do with any professional-services firm weighing an AI tool: what it saves, what it exposes, and how to capture the first without the second.

Key takeaways

Common questions

Related notes

Weighing an AI scribe for your practice?

Book a call and we'll map the tool against your privacy, consent and indemnity obligations — and work out whether it earns its place before you sign anything.